ROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEXROLEX

pdoukas · 12 January 2012, 08:41 AM

There is a post in the vintage forum titled "Which one is better" by a new member with only 2 postings. The member,s name is danzaqk. His second posting is in the general forum titled "my birthday gift".

In both postings, he has embedded a .php file within the post, that is possibly gathering tracking information maliciously. You can find it by just hovering over the link of either post but not going to it and you'll see he has linked his pictures from "whatever site" and the tracking .php from c***egefun4u.c0m (the 0 in com was intentionally done by me).

Most likely this person is trying to gather IP Address info to check computer security from people who like rolexes.

I see this kinda crap all the time......just thought I would point it out.

Pete

Welshwatchman · 12 January 2012, 09:01 AM

Also reported by Matt.

Deleted the "member" and his so called posts.

Good catch both, keep vigilant everyone.

matt4hand · 12 January 2012, 09:16 AM

Quote:

Originally Posted by pdoukas

There is a post in the vintage forum titled "Which one is better" by a new member with only 2 postings. The member,s name is danzaqk. His second posting is in the general forum titled "my birthday gift".

In both postings, he has embedded a .php file within the post, that is possibly gathering tracking information maliciously. You can find it by just hovering over the link of either post but not going to it and you'll see he has linked his pictures from "whatever site" and the tracking .php from c***egefun4u.c0m (the 0 in com was intentionally done by me).

Most likely this person is trying to gather IP Address info to check computer security from people who like rolexes.

I see this kinda crap all the time......just thought I would point it out.

Pete

Quote:

Originally Posted by Welshwatchman

Also reported by Matt.

Deleted the "member" and his so called posts.

Good catch both, keep vigilant everyone.

That's why this place rocks!

TheVTCGuy · 12 January 2012, 09:30 AM

I'ts JOCKE!!!!!!!

HL65 · 12 January 2012, 10:05 AM

Good catch guys!!

dddrees · 12 January 2012, 10:10 AM

Quote:

Originally Posted by steelerfan65

good catch guys!!

x2

BarkMaster · 12 January 2012, 10:53 AM

Good catch!

beowulf566 · 12 January 2012, 11:32 AM

Good job helping to keep this place as safe as possible.

bellvederecar · 12 January 2012, 12:32 PM

Great catch, thanks a ton. Just had 7800 on my amex that wasn't mine. These dirt bags are everywhere!

keschete · 12 January 2012, 12:55 PM

Awesome work guys!!!

cedargrove · 12 January 2012, 01:40 PM

You guys are freaking awesome. Thanks to all involved in keeping this place safe from these pieces of sh!t.

bayerische · 12 January 2012, 06:35 PM

Scary!

Good you caught the Bastid!

MonBK · 12 January 2012, 07:56 PM

Good job.

Johny · 13 January 2012, 12:12 AM

well done guys. thank you.

Sarajevo · 13 January 2012, 12:15 AM

You can run but you cannot hide! Thanks for keeping us safe.

Lion · 13 January 2012, 12:16 AM

You always have to be careful and use common sense when dealing with others.....

rolio · 13 January 2012, 12:18 AM

Quote:

Originally Posted by TheVTCGuy

I'ts JOCKE!!!!!!!

I agree! I think it is Jocke, too.

Watch Professor · 13 January 2012, 12:20 AM

Great pick up. Thanks for keeping us safe from these *******.

psv · 13 January 2012, 12:32 AM

Nice catch. Thanks!

mjclark32 · 13 January 2012, 12:49 AM

Quote:

Originally Posted by beowulf566

Good job helping to keep this place as safe as possible.

chicfarmer1 · 13 January 2012, 01:36 AM

If we viewed his linked pics, what is the risk, and is there some way to undo any damage?

Thank you all for your attentive help!

F&Iguy · 13 January 2012, 01:58 AM

like everyone has said thanks and good work

Cru Jones · 13 January 2012, 03:11 AM

jeez....didn't know this kind of stuff even went on.

thanks for protecting us!

Bdevenney · 13 January 2012, 04:30 AM

Good catch!

Route 66 · 13 January 2012, 05:06 AM

I'm sure glad there are guys here who know enough about computers to be able to catch things like this.

Thanks to the Mods for being there for us.

T.S.Eliot · 13 January 2012, 06:21 AM

The way I see it, his posts shouldn't have been allowed in the first place. I'm not an IT expert, but I think a good anti spyware could have solved the problem.

MP5 · 13 January 2012, 06:28 AM

Any risk we should be looking for to make sure this guy didn't get any of us?

ft laud mike · 13 January 2012, 08:39 AM

Quote:

Originally Posted by SteveArn

I'm sure glad there are guys here who know enough about computers to be able to catch things like this.

Thanks to the Mods for being there for us.

Thanks to those who are more computer literate than me

pdoukas · 14 January 2012, 01:12 AM

I want to apologize, I was actually searching for an older post of mine and found my post from the other day. I didn't realize it was moved, I simply thought it was deleted after the issue was resolved. In hindsight, after the post, I thought it was bad etiquette posting in public, but I didn't know who to discuss my finding with. In the future I will post in the general forum.

With that said, I will answer some of the questions that have been asked.

1) Viewing the pictures will not cause any damage. It was a tracking script that was just gleaning information from anyone that viewed the post. Similar to a cookie when you browse websites.

2) The information that it was tracking was most likely designed to get the IP Address (internet address) from the people that were looking at the post, including mine.

3) Antivirus, and/or anti malware wouldn't help. It was not uploading or downloading anything, just checking you out.

4) Most likely the script was designed to log IP Addresses. In this case, log IP Addresses from forum members that buy expensive watches, hence, from people who have a little money to burn. What these people do then is scan the available IP Addresses and see what kind of security is on the other end of the IP Address.

From that point on it is a mixed bag. That is to say, you're only as secure as long as you are well informed. So let me elaborate a little and you'll be ok in the long run.

1) If you do not have a router with built in security on the end of your PC then you're an open book. You'd be amazed how many people do not. Get a freaking router!

2) If you do have a router, change the default manufacturer password. Once again, you'd be amazed at how many people who do not.

4) Don't fall under the guise that just because you have an Apple or run Linux you're safe. Nothing is secure......period!

3) Use a password that is secure on that router. I know you've read this before and I know you hate thinking of a password that has upper and lower case characters with numbers and symbols. It's so much easier to remember your cats name "franklin". However, these guys employ password lists that automate the process and believe me "franklin" can be cracked in 2 minutes. Instead try"fR@nK1i^" .....looks like "franklin" smells like "franklin" but it ain't "franklin".

4) Keep your PC up to date with the software updates. They provide them for a reason.

5) Use antivirus and anti spyware. AVG is free. I like ESET as the footprint on the PC is smaller than most and doesn't use too many resources. Keep the definitions up to date as well.

I'm glad to have helped. This place is great. However, with anything, people will try to make a good thing bad. Practice those few things and you'll be ok.

Pete

MoBe · 14 January 2012, 04:08 AM

Thanks Pete !

12 January 2012, 08:41 AM	#1
pdoukas "TRF" Member Join Date: Dec 2010 Real Name: Pete Location: Arizona Watch: ing Duke bball Posts: 1,488	Need a MOD to read There is a post in the vintage forum titled "Which one is better" by a new member with only 2 postings. The member,s name is danzaqk. His second posting is in the general forum titled "my birthday gift". In both postings, he has embedded a .php file within the post, that is possibly gathering tracking information maliciously. You can find it by just hovering over the link of either post but not going to it and you'll see he has linked his pictures from "whatever site" and the tracking .php from c***egefun4u.c0m (the 0 in com was intentionally done by me). Most likely this person is trying to gather IP Address info to check computer security from people who like rolexes. I see this kinda crap all the time......just thought I would point it out. Pete

12 January 2012, 09:01 AM	#2
Welshwatchman "TRF" Member Join Date: Apr 2006 Real Name: Paul Location: Wales, UK Posts: 14,578	Also reported by Matt. Deleted the "member" and his so called posts. Good catch both, keep vigilant everyone. __________________ ..33

12 January 2012, 10:05 AM	#5
HL65 TRF Moderator & 2024 SubLV41 Patron Join Date: Dec 2007 Real Name: Ken Location: SW Florida Watch: One on my wrist. Posts: 64,006	Good catch guys!! __________________ *SPEM SUCCESSUS ALIT*

12 January 2012, 10:53 AM	#7
BarkMaster "TRF" Member Join Date: Jul 2009 Location: Texas Watch: 18078 YG DD Posts: 7,962	Good catch! __________________ BARK BARK BARK BARK BARK BARK BARK BARK BARK BARK BARK BARK

12 January 2012, 11:32 AM	#8
beowulf566 "TRF" Member Join Date: Dec 2010 Real Name: Matt Location: new hampshire Watch: Rlx,Omga,CyS,brtln Posts: 1,520	Good job helping to keep this place as safe as possible. __________________ R.I.P. Smoke em' if you got em'

12 January 2012, 09:30 AM	#4
TheVTCGuy Banned Join Date: Jul 2008 Real Name: Paul Location: San Diego Watch: 126619LB Posts: 21,540	I'ts JOCKE!!!!!!!

12 January 2012, 12:32 PM	#9
bellvederecar "TRF" Member Join Date: Jun 2010 Real Name: d Location: boston Watch: all Posts: 324	Great catch, thanks a ton. Just had 7800 on my amex that wasn't mine. These dirt bags are everywhere!

12 January 2012, 12:55 PM	#10
keschete "TRF" Member Join Date: Oct 2007 Real Name: Kaya Location: Louisiana Watch: 116500 Posts: 3,575	Awesome work guys!!! __________________ GMT II BLNR, Submariner, Submariner Serti, Datejust, Daytona C, TT Yacht Master, Hulk Submariner, Pepsi GMT II

12 January 2012, 01:40 PM	#11
cedargrove "TRF" Member Join Date: Dec 2010 Real Name: Rich Location: Canada Watch: Milgauss, GMT IIc Posts: 3,013	You guys are freaking awesome. Thanks to all involved in keeping this place safe from these pieces of sh!t.

12 January 2012, 06:35 PM	#12
bayerische "TRF" Member Join Date: Nov 2009 Real Name: Andreas Location: Margaritaville Watch: Smurf Posts: 19,879	Scary! Good you caught the Bastid! __________________ Yeah, well, you know, that's just, like, your opinion, man.

12 January 2012, 07:56 PM	#13
MonBK Banned Join Date: Nov 2010 Location: Kingstown Posts: 58,279	Good job.

13 January 2012, 12:12 AM	#14
Johny "TRF" Member Join Date: Mar 2010 Real Name: john Location: Scotland Watch: sub 16610Lv Posts: 13,523	well done guys. thank you. __________________ "AFTER DARK" BAR AND NIGHT CLUB GM.

13 January 2012, 12:15 AM	#15
Sarajevo "TRF" Member Join Date: Aug 2010 Location: The Netherlands Watch: 16600371701 Posts: 1,271	You can run but you cannot hide! Thanks for keeping us safe.

13 January 2012, 12:16 AM	#16
Lion "TRF" Member Join Date: Jan 2009 Real Name: Leo Location: Midwest Watch: GMT-II 16710 PEPSI Posts: 21,461	You always have to be careful and use common sense when dealing with others..... __________________ SS GMT-II 16710 PEPSI(Z-serial#) THE ONLY DIFFERENCE BETWEEN MEN AND BOYS IS THE PRICE OF THE TOYS!!! MontBlanc Meisterstuck Doue Silver Barley MontBlanc Meisterstuck Solitaire Doue Signum Proud Card Carrying Member of the Curmudgeons.....Yikes!!!

13 January 2012, 12:20 AM	#18
Watch Professor "TRF" Member Join Date: Oct 2009 Real Name: Myron Location: New York Watch: GMT IIC; Sub Date Posts: 3,166	Great pick up. Thanks for keeping us safe from these *******. __________________

13 January 2012, 12:32 AM	#19
psv 2024 Pledge Member Join Date: Oct 2009 Location: USA & France Posts: 11,078	Nice catch. Thanks!

13 January 2012, 01:36 AM	#21
chicfarmer1 "TRF" Member Join Date: Oct 2010 Real Name: J Location: USA Midwest Watch: Midsize Datejust Posts: 2,611	If we viewed his linked pics, what is the risk, and is there some way to undo any damage? Thank you all for your attentive help!

13 January 2012, 01:58 AM	#22
F&Iguy "TRF" Member Join Date: Sep 2011 Location: WA state Watch: EXP 39mm Posts: 278	like everyone has said thanks and good work

13 January 2012, 03:11 AM	#23
Cru Jones 2024 SubLV41 Pledge Member Join Date: Mar 2010 Location: Paris, France Posts: 35,300	jeez....didn't know this kind of stuff even went on. thanks for protecting us!

13 January 2012, 04:30 AM	#24
Bdevenney "TRF" Member Join Date: Feb 2011 Location: Philadelphia, PA Watch: 116610LN Posts: 224	Good catch!

13 January 2012, 05:06 AM	#25
Route 66 "TRF" Member Join Date: Apr 2010 Real Name: Steve Location: Burbank, CA Watch: 214270 Mark II Posts: 4,121	I'm sure glad there are guys here who know enough about computers to be able to catch things like this. Thanks to the Mods for being there for us.

13 January 2012, 06:21 AM	#26
T.S.Eliot "TRF" Member Join Date: Jan 2011 Real Name: K Location: KSA Watch: aholic Posts: 1,499	The way I see it, his posts shouldn't have been allowed in the first place. I'm not an IT expert, but I think a good anti spyware could have solved the problem.

13 January 2012, 06:28 AM	#27
MP5 2024 SubLV41 Pledge Member Join Date: May 2009 Location: ATX Posts: 2,886	Any risk we should be looking for to make sure this guy didn't get any of us?

14 January 2012, 01:12 AM	#29
pdoukas "TRF" Member Join Date: Dec 2010 Real Name: Pete Location: Arizona Watch: ing Duke bball Posts: 1,488	I want to apologize, I was actually searching for an older post of mine and found my post from the other day. I didn't realize it was moved, I simply thought it was deleted after the issue was resolved. In hindsight, after the post, I thought it was bad etiquette posting in public, but I didn't know who to discuss my finding with. In the future I will post in the general forum. With that said, I will answer some of the questions that have been asked. 1) Viewing the pictures will not cause any damage. It was a tracking script that was just gleaning information from anyone that viewed the post. Similar to a cookie when you browse websites. 2) The information that it was tracking was most likely designed to get the IP Address (internet address) from the people that were looking at the post, including mine. 3) Antivirus, and/or anti malware wouldn't help. It was not uploading or downloading anything, just checking you out. 4) Most likely the script was designed to log IP Addresses. In this case, log IP Addresses from forum members that buy expensive watches, hence, from people who have a little money to burn. What these people do then is scan the available IP Addresses and see what kind of security is on the other end of the IP Address. From that point on it is a mixed bag. That is to say, you're only as secure as long as you are well informed. So let me elaborate a little and you'll be ok in the long run. 1) If you do not have a router with built in security on the end of your PC then you're an open book. You'd be amazed how many people do not. Get a freaking router! 2) If you do have a router, change the default manufacturer password. Once again, you'd be amazed at how many people who do not. 4) Don't fall under the guise that just because you have an Apple or run Linux you're safe. Nothing is secure......period! 3) Use a password that is secure on that router. I know you've read this before and I know you hate thinking of a password that has upper and lower case characters with numbers and symbols. It's so much easier to remember your cats name "franklin". However, these guys employ password lists that automate the process and believe me "franklin" can be cracked in 2 minutes. Instead try"fR@nK1i^" .....looks like "franklin" smells like "franklin" but it ain't "franklin". 4) Keep your PC up to date with the software updates. They provide them for a reason. 5) Use antivirus and anti spyware. AVG is free. I like ESET as the footprint on the PC is smaller than most and doesn't use too many resources. Keep the definitions up to date as well. I'm glad to have helped. This place is great. However, with anything, people will try to make a good thing bad. Practice those few things and you'll be ok. Pete

14 January 2012, 04:08 AM	#30
MoBe "TRF" Member Join Date: Sep 2011 Location: Canada Posts: 6,773	Thanks Pete !

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)